Loading malware…
Defender Control is a utility used by threat actors for defense evasion by disabling Microsoft Defender. In the provided reporting, Elastic observed Cuba ransomware-associated operators using DefenderControl.exe to disable Microsoft Defender and using svchost.exe to create a scheduled task to keep it running during intrusions affecting North American and European retailers and manufacturers. ASEC also reported Trigona threat actor activity against publicly exposed or weakly protected MS-SQL servers in which the actor used Defender Control alongside other privilege-related tools sourced from GitHub. High-confidence behavior directly described in the content is limited to disabling Microsoft Defender; the content also notes that other privilege escalation tools are available in Defender Control and GitHub, but does not attribute specific additional capabilities to this malware with certainty. Associated activity in the cited campaigns included ransomware operations, remote administration tooling, credential theft, lateral movement, and persistence, but Defender Control’s directly stated role was defense evasion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the threat actors used Defender Control as a way to disable Microsoft Defender
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Microsoft Defender Real Time Protection was disabled... The attacker leveraged the utility defender-control to modify registry keys associated with Microsoft Defender configuration.
Microsoft Defender Real Time Protection was disabled... The attacker leveraged the utility defender-control to modify registry keys associated with Microsoft Defender configuration... These modifications effectively disabled key protection features, allowing the attacker to operate without interference.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool referenced as used/available to the actor to weaken or disable Microsoft Defender protections as part of post-compromise activity.
Tool used to disable Microsoft Defender to evade detection; persistence maintained via scheduled task execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.